CVE-2024-45614
MediumCVSS 5.4Summary
Puma is a Ruby/Rack web server. In affected versions clients could clobber values set by intermediate proxies (such as X-Forwarded-For) by providing an underscore version of the same header (X-Forwarded_For). v6.4.3/v5.6.9 now discard any headers using underscores if the non-underscore version also exists, so proxy-defined headers always win.
Risk Assessment
Users relying on proxy-set variables may be exposed to header spoofing, potentially leading to access control bypass or data injection.
Recommendation
Update Puma to version 6.4.3 or 5.6.9 (or later). Consider enabling Nginx underscores_in_headers to discard such headers at the proxy level.
Other vulnerabilities in Puma
See all- CVE-2026-68006Critical
An issue in Puma v.5.0.0 and before v.8.0.3 allows an attacker to execute arbitrary code via the ext/puma_http11/http11_parser.rl file.
- CVE-2026-47737High
Puma versions 5.5.0 through 7.2.1 and 8.0.2 are vulnerable to source IP spoofing. When proxy_protocol: :v1 is enabled and persistent connections are used, Puma incorrectly re-parses PROXY headers after each keep-alive request, allowing an attacker to inject a second PROXY header and overwrite REMOTE_ADDR.
- CVE-2026-47736High
A vulnerability in Puma (versions 5.5.0 through 7.2.1 and 8.0.2) with PROXY protocol v1 support enabled allows an attacker to continuously send bytes without CRLF, causing unbounded in-process memory growth and additional CPU cost from repeatedly scanning the growing buffer.
- CVE-2023-40175High
Puma, a Ruby/Rack web server, prior to versions 6.3.1 and 5.6.7, exhibited incorrect behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers, allowing for HTTP request smuggling.
Original NVD description (English source)
Puma is a Ruby/Rack web server built for parallelism. In affected versions clients could clobber values set by intermediate proxies (such as X-Forwarded-For) by providing a underscore version of the same header (X-Forwarded_For). Any users relying on proxy set variables is affected. v6.4.3/v5.6.9 now discards any headers using underscores if the non-underscore version also exists. Effectively, allowing the proxy defined headers to always win. Users are advised to upgrade. Nginx has a underscores_in_headers configuration variable to discard these headers at the proxy level as a mitigation. Any users that are implicitly trusting the proxy defined headers for security should immediately cease doing so until upgraded to the fixed versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS